IB3-2

Environment independent IT-management for low-cost and robustness operation

Tsunemasa Hayashi

IB3-2

Topic area: ICT management

• Many type of services and devices has been deployed.-> Low Opex

ICETC2020 2

User

IoT devices

Linux

Network NodesRNC/BTS, AP

Windows

IoT Gateway

IB3-2

Summary

• how management interface against number of components in ICT infrastructure are integrated into single management

• how the behavior against management interface is logged for each connection to the infrastructure

• operation correctness from logged session data• the feasibility in a commercial environment with 100,000 nodes as ICT

infrastructure

ICETC2020 3

IB3-2

Background

• microservices to quickly provide various kinds of service deployments • several kinds of infrastructure orchestration tools are becoming ready on

commercial environment• Quickly deploy not only applications but also for network elements• Just push code or configuration without human operation on the

provisioning phase• still required to access ICT infrastructure directly on the management

phase• harder to check what is going on when problem occurred in target service• human operation error is still the critical factor of service failure

ICETC2020 4

IB3-2

Proposal overview

• investigated protocol-based connection integration system as connection proxy gateway

• integrate all the management interface into single management system• provide logging management operations• provide connection restriction features

ICETC2020 5

IB3-2

architecture of connection proxy gateway

Web UI Connector

Web proxy

CLI proxy

Imagebaseddata

transfer

OperatorSSH / telnet

RDP

SSH

HTTP(S)

RDP / VNC

SSH / telnet

connection proxy gateway

HTTP(S)

ICETC2020 6

IB3-2

Issues on this architecture

• cannot support application dedicated protocol(e.g.) between vSphere Client and vCenter server

• integrate “Windows OS” into the connection proxy gateway as liaison

ICETC2020 7

IB3-2

Enhanced architecture for dedicated protocol

• RDP protocol from the Connector are transfer to the application dedicated protocol

ICETC2020 8

OperatorSSH / telnet

HTTP(S)

Windows liaison(Windows OS)

SSH / telnet

connection proxy

gateway

HTTP(S) dedicated protocol RDP

IB3-2

Architecture of typical implementation

Administrator

OperatorConnection

proxygateway

ElasticsearchSt

ore

log Check logs

Network equipments

Servers

make session

Create connection

Investigatecorrectness

ICETC2020 9

IB3-2

mitigates human operation error on ICT infrastructure

1. Create connections dynamically for user based on service deployment2. Design human operation for login to ICT infrastructure3. RDP or SSH or HTTP session against ICT infrastructure via Web UI4. Check and investigate logged session data

ICETC2020 10

IB3-2

Results

ICETC2020 11

IB3-2

SSH connection via Web UI

ICETC2020 12

IB3-2

RDP connection via Web UI

ICETC2020 13

IB3-2

HTTPS connection via Web UI

ICETC2020 14

IB3-2

Session log

ICETC2020 15

IB3-2

Command log

ICETC2020 16

IB3-2

URL request log

ICETC2020 17

IB3-2

File transfer log

ICETC2020 18

IB3-2

operation correctness or illegal / irregular from the session logs

1. Aggregate the number of occurrences per command2. Apply a heuristic algorithm with log (count +1) to the number of

appearances

ICETC2020 19

User A User B User CUser A 0.9998 0.0082 0.0000User B 0.0000 0.4980 0.0000User C 0.0000 0.0000 0.9503

Evaluation data

Trainingdata

the value of p is less than 1%

IB3-2

Conclusion

• client-less and centralized connection management against ICT infrastructure-> protocol-based connection integration system to manage the infra.

• each logging feature records user behavior in detailed level-> distinguish normal operation from operation log

• Feasible in a commercial environment with 100,000 (capability 400,000)-> can handle 10,000 SSH, RDP and HTTPS sessions at the same time

ICETC2020 20

IB3-2